import { SignJWT, importJWK, type JWK } from 'jose';

export interface GenerateClientAssertionInput {
  clientId: string;
  audience: string;
  privateJwk: JWK;
  expiresIn?: string;
}

// Mirrors the National ID Program's own reference implementation
// (fayda-auth-python): plain {alg: RS256} header, no kid, no jti — eSignet
// resolves the verification key from client_id alone.
export async function generateClientAssertion(
  input: GenerateClientAssertionInput,
): Promise<string> {
  const privateKey = await importJWK(input.privateJwk, 'RS256');
  return new SignJWT({})
    .setProtectedHeader({ alg: 'RS256' })
    .setIssuer(input.clientId)
    .setSubject(input.clientId)
    .setAudience(input.audience)
    .setIssuedAt()
    .setExpirationTime(input.expiresIn ?? '2m')
    .sign(privateKey);
}